Analysis
-
max time kernel
116s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe
Resource
win7-20240903-en
General
-
Target
bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe
-
Size
1024KB
-
MD5
5218d29024fe782f2b3a89c8f2126280
-
SHA1
00c48ebcf9eebce4e6553685b51e81bf5ae157e1
-
SHA256
bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70
-
SHA512
6a14eba5410dbb9a2104652a66136003e5c83e4639180588b507a5a18c047ac77fe8c59d48808ad4e51b1482c0ebe47bf18a29699dbc92585af0b8001f10caf8
-
SSDEEP
12288:a6eVQkTrvj4d+dONGRpz5ljXeLY8Kk5tqGN0GvTBb/A4h75L:anQkTf4d+INGxetl0GrBb/A675
Malware Config
Extracted
latentbot
patrickstar23.zapto.org
1patrickstar23.zapto.org
2patrickstar23.zapto.org
3patrickstar23.zapto.org
4patrickstar23.zapto.org
5patrickstar23.zapto.org
6patrickstar23.zapto.org
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2304 set thread context of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe vbc.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 692 reg.exe 4660 reg.exe 1456 reg.exe 388 reg.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe Token: 1 1672 vbc.exe Token: SeCreateTokenPrivilege 1672 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1672 vbc.exe Token: SeLockMemoryPrivilege 1672 vbc.exe Token: SeIncreaseQuotaPrivilege 1672 vbc.exe Token: SeMachineAccountPrivilege 1672 vbc.exe Token: SeTcbPrivilege 1672 vbc.exe Token: SeSecurityPrivilege 1672 vbc.exe Token: SeTakeOwnershipPrivilege 1672 vbc.exe Token: SeLoadDriverPrivilege 1672 vbc.exe Token: SeSystemProfilePrivilege 1672 vbc.exe Token: SeSystemtimePrivilege 1672 vbc.exe Token: SeProfSingleProcessPrivilege 1672 vbc.exe Token: SeIncBasePriorityPrivilege 1672 vbc.exe Token: SeCreatePagefilePrivilege 1672 vbc.exe Token: SeCreatePermanentPrivilege 1672 vbc.exe Token: SeBackupPrivilege 1672 vbc.exe Token: SeRestorePrivilege 1672 vbc.exe Token: SeShutdownPrivilege 1672 vbc.exe Token: SeDebugPrivilege 1672 vbc.exe Token: SeAuditPrivilege 1672 vbc.exe Token: SeSystemEnvironmentPrivilege 1672 vbc.exe Token: SeChangeNotifyPrivilege 1672 vbc.exe Token: SeRemoteShutdownPrivilege 1672 vbc.exe Token: SeUndockPrivilege 1672 vbc.exe Token: SeSyncAgentPrivilege 1672 vbc.exe Token: SeEnableDelegationPrivilege 1672 vbc.exe Token: SeManageVolumePrivilege 1672 vbc.exe Token: SeImpersonatePrivilege 1672 vbc.exe Token: SeCreateGlobalPrivilege 1672 vbc.exe Token: 31 1672 vbc.exe Token: 32 1672 vbc.exe Token: 33 1672 vbc.exe Token: 34 1672 vbc.exe Token: 35 1672 vbc.exe Token: SeDebugPrivilege 1672 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1672 vbc.exe 1672 vbc.exe 1672 vbc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 2304 wrote to memory of 1672 2304 bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe 82 PID 1672 wrote to memory of 4068 1672 vbc.exe 83 PID 1672 wrote to memory of 4068 1672 vbc.exe 83 PID 1672 wrote to memory of 4068 1672 vbc.exe 83 PID 1672 wrote to memory of 1472 1672 vbc.exe 84 PID 1672 wrote to memory of 1472 1672 vbc.exe 84 PID 1672 wrote to memory of 1472 1672 vbc.exe 84 PID 1672 wrote to memory of 2980 1672 vbc.exe 85 PID 1672 wrote to memory of 2980 1672 vbc.exe 85 PID 1672 wrote to memory of 2980 1672 vbc.exe 85 PID 1672 wrote to memory of 5060 1672 vbc.exe 86 PID 1672 wrote to memory of 5060 1672 vbc.exe 86 PID 1672 wrote to memory of 5060 1672 vbc.exe 86 PID 5060 wrote to memory of 4660 5060 cmd.exe 91 PID 5060 wrote to memory of 4660 5060 cmd.exe 91 PID 5060 wrote to memory of 4660 5060 cmd.exe 91 PID 4068 wrote to memory of 692 4068 cmd.exe 92 PID 4068 wrote to memory of 692 4068 cmd.exe 92 PID 4068 wrote to memory of 692 4068 cmd.exe 92 PID 1472 wrote to memory of 388 1472 cmd.exe 93 PID 1472 wrote to memory of 388 1472 cmd.exe 93 PID 1472 wrote to memory of 388 1472 cmd.exe 93 PID 2980 wrote to memory of 1456 2980 cmd.exe 94 PID 2980 wrote to memory of 1456 2980 cmd.exe 94 PID 2980 wrote to memory of 1456 2980 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe"C:\Users\Admin\AppData\Local\Temp\bd7d710c5e3bcef37896ef22a6ff38128064a2ad870799da3c88466fc71b9d70N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:692
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:388
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4660
-
-
-